Security1 publisher2 min readPublished
Malicious instructions hidden in MCP tool descriptions inherit the agent's system-level authority
The same weakness turns up in Cursor's XML tags, MCP tool definitions and skill YAML frontmatter. Each one puts attacker-controlled text where a coding agent already treats it as its own instructions.
The Watch · Security desk
What happened
- Remote MCP servers can change their content after an agent's permissions have been granted, so an integration approved once can stop being the thing that was approved.
- Skill metadata in YAML frontmatter is loaded into the system prompt before the skill's executable logic runs, carrying hidden permissions, trigger conditions and model configuration changes.
- CopyPasta research disguised instructions as a required license header, and coding agents then copied the payload into every repository they modified.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability A header-shaped injection that the agent itself replicates moves the unit of compromise from one session to every repository the agent has write access to, and cleanup becomes a review of all of them.
- constraint Pinning versions is the one control that stops a component changing under you, and it reaches one of the five techniques; the other four have to be caught in content at the moment it is loaded.
- decision Every control on the list is a permission, an approval gate or a network limit, so the spend and the argument sit with harness configuration.
- exposure A team that vets a third-party skill by reading its code still inherits whatever the frontmatter told the model. The review boundary sits below the line where the instructions actually land.
An agent's system prompt is where its authority lives, and two of these channels write straight into it. MCP tool definitions are frequently placed there, so a tool description or a parameter arrives as instruction text carrying system-level authority [3]. Skill metadata in YAML frontmatter loads into the same prompt before the skill's executable logic ever runs [5]. Hidden permissions, trigger conditions and model configuration changes therefore take effect in the part of a skill that users and marketplaces do not usually review [5].
Cursor needed less than that. Wrapping malicious instructions in a trusted `<user_query>` tag was enough for the agent to read them as legitimate user input, with no traditional prompt-injection technique involved [2]. The CopyPasta research aimed at persistence instead: instructions disguised as a required license header got coding agents to copy the payload into every repository they modified [6]. Neither case needs a flaw in the model: both work on a model behaving as designed, reading text the harness told it to trust [1].
Five techniques are described in total. The framework's validation layer says to approve specific versions rather than continuously trusting "latest" [9], and that covers exactly one of them, the remote MCP server that changes after permissions have already been granted [4]. The other four arrive inside content the harness loads at run time. Inspecting that content as it loads is a different problem from pinning a version [1].
The rest of the model is permissions and process. Control means least privilege by default, human approval for high-impact actions, an allowlist of tools, MCP servers and skills, limits on unnecessary outbound network access, and a review of system prompts and default configurations before deployment [8]. Monitoring is put explicitly outside the model, covering sensitive data movement, tool usage and file operations, privilege escalation attempts, shadow AI and abnormal compute consumption [10]. Governance assigns an owner to every production agent and asks for incident response procedures specific to agentic AI [12].
The piece carries no CVE identifiers, no dates, no affected version ranges, and no claim that any of these techniques has been exploited in the wild [15]. It was published under scworld.com's native path [13] and continues an argument the same authors made in an earlier piece [14]. The OpenAI model evaluation incident it cites as evidence that unexpected behavior can emerge inside otherwise legitimate environments is named and not described [11].
What to watch
- A CopyPasta-style self-propagating injection reported in a named repository, with dates and a count of affected projects.
- Any change in how Cursor or MCP implementations load tool definitions and descriptions into the system prompt.
- Skill marketplaces extending review to YAML frontmatter, beyond the executable portion of a skill.